Today Microsoft announces OpFauxSign, an action against of "Fox Tempest" aka "SamCodeSign" infrastructure and "Vanilla Tempest", allegedly "members of an organized cybercriminal enterprise that has fraudulently obtained code signing certificates from Microsoft's Artifact Signing service, using those certificates to sign malware, and deploying the malware to gain unauthorized access to victim computers for the purpose of stealing information, deploying ransomware, and extorting victims". It is reported that "SamCodeSign was involved into the fraudulent creation of more than 580 Microsoft tenants", as I understand, 580 different EV signers that were used to generate 1 or more EV certificates per signer (as observed and tracked), and then sold to other threat actors like Vanilla Tempest that used these EV certificates, for example, in Oyster malware campaigns masqueraded as popular software including Microsoft Teams. More info: blogs.microsoft.com/on-the-i… and documents: aka.ms/OpFauxSign On the CertGraveyard platform, certgraveyard.org , @SquiblydooBlog and I (and few other contributors) have been tracking this kind of abuse of EV certs and their usage in malware campaigns in the wild, being Microsoft-issued EV certs one of the most used assets by threat actors in the recent times, in multiple and different unrelated campaigns. The complaint and related documents shared by Microsoft gives some rich visibility into the cybercrime ecosystem involving the abuse of EV certificates, a problem that has been around for years.

A fake RVTools build, signed "Xiamen Lunwei Huage Network Co., Ltd." (Sectigo), delivered from an unknown source leading to a Python-based RAT likely used as an initial access tool: d0f5e98fb840fb5656d3f50613b6f1ec60e57392643159841bc1fa95396087a4 Detonation: app.any.run/tasks/7583b22d-f… Installer downloads via Powershell from Dropbox a .zip containing two obfuscated Python Scripts and executes them: collector .py (fc146e0907d2c1f182f01bb7417c9e4b1b9854395fa267c1093b4f5a0f7f526c) It collects detailed system reconnaissance data: machine ID, hostname, username, domain, privilege level, full system info, running processes, services, network connections, ARP table, and Active Directory-related data, writing results to a file "configA.json" Pmanager .py aeb1cca563df283b3d4065e601f0ac053559f20c681eb70ded38717c1fc259a9 It connects to any of the following C2 using custom encryption communication: 45.61.136.94 64.95.12.238 162.33.179.149 64.95.13.76 64.95.10.14 It also performs system reconnaissance, sending information to C2, and can execute arbitrary PowerShell commands received from C2 as a full remote shell, save and execute exe, dll, msi or python files and also installing persistence on infected machine. All tasks performed on machine are tracked back to C2.

A kind message from threat actors, not funny))

⚠️Watch out for a SEO poisoning campaign impersonating VMware vSphere downloads leveraging MeshCentral RMM tool bundled into fake installers targeting enterprise environments. Sample: dbfe1f915f40122a336cd5d0de802a6f3ec0204ab75321934a06dafbc1964446 Detonation: app.any.run/tasks/e0937ead-4… From malicious search results -> vmware-vsphere[.]com (associates, vmwarevsphere[.]com, vmware-remote-console[.]com, remote-console-vmware[.]com, vsphere-client[.]com, vsphere-client[.]org ) leading to vmware-repository[.]com A malicious build with EV signature issued to malicious signer "Pacex Learning Private Limited" (Globalsign) is delivered from Dropbox. The build connects to 103.65.230.86 (MeshCentral RMM C2) and installs legit VMware product as decoy

News - February 19, 2026 Five residents of Yugra, the Republic of Komi, and the Tyumen region, aged 21 to 36 (Russia 🇷🇺) are accused of spreading malware worldwide and will face trial. "The criminals engaged in illegal activities from September 2021 to May 2022. The organizer ,a 21 year old resident of Surgut, involved four accomplices in the criminal scheme through closed communities" "On a popular video hosting platform, the accomplices posted videos in which they offered to download a program under the guise of game add-ons, supposedly giving a gaming advantage. Users, by clicking on the links specified in the description, downloaded not only the plug-in but also a malicious application that did not require installation and ran covertly on their computers. This allowed the defendants to gain access to the players' personal data. Then the accomplices collected various information about the citizens and handed it over to unidentified individuals for a fee. According to investigators, more than a thousand computers belonging to users not only from Russia, but also from countries near and far abroad, were infected." Source: t.me/police_ugra/8909 Summarizing, caught after committing crimes spreading infostealers on YouTube as game cheats 4 years ago. It is interesting to see the images that police officers shared, showing the devices seized, but most important the two telegram screenshots showing a chat (with images of a Redline stealer advertisement) and also a screenshot of a bot of a traffer team (MMM) that I tried to profile it a bit in the past here -> medium.com/@g0njxa/profiling… As I show in the blog, MMM team offered META (the Redline stealer variant that had no GEO block and could have stolen information from all computers worldwide) to their "workers". As police details, this cybercriminals spread the builds to generate infostealer logs (shown in the screenshot in zip format) for the usage on further criminal activities This traffer team closed, their administrator started developing and selling their new malware solution (D3F@CKLoader malware) and then become GlobalMan, one of the biggest EV cert sellers. No further information about this old traffer team is provided

Fake Webex to DigitStealer (macOS) + another Windows electron-based stub. Likely traffer activity targeting web3 users🧵 Example live link (image 1) using (or impersonating) @Overdroid_eth template hxxps://mediu.cisco-webex.cc/overdroid/j.php?MTID=mea7c0d1c5e3e37304e8e300badac8ef0 Active Webex impersonation under 93.152.230.130 - > @urlscanio urlscan.io/search/#page.ip:%… Download notifications are being send to hxxps://api.mediu.ciscomediu.com/download-handler.php Fingerprinting the browser, checking for possible OS spoofing and checking for crypto wallets installed in the browser, also generating download links for each client depending on the OS (macOS or Windows) Malware below

Currently seeing a surge on #CastleLoader malware being delivered through fake websites impersonating software used in enterprise environments such as Zabbix or RVTools (see photo 1 & 2). IOCS below 👾🔎 Please note that this campaign uses the same exact template lures of previous observed #Bumblebee campaigns back in Summer 2025, disappeared for some months. Efforts put into disrupting Bumblebee infrastructure could have made the folks behind these campaigns to migrate into other malware options such as observed CastleLoader The CastleLoader builds, hosted on fake Github repos (see photo 3), are being delivered as EV cert signed MSI builds (also like the previous Bumblebee campaigns), leading to other malware such as NetSupport RAT. The abuse of EV certificates by this malware can be tracked on CertCentral by @SquiblydooBlog (certcentral.org/lookup?detai…) IOCS ~Signatures LLC KHD GROUP (GlobalSign) INTYNA EXIM PRIVATE LIMITED (SSLdotcom) ~ Samples ed93f66bcda92e8db51e897ec0dd70412356b148a50ec86d218533e7c37ba6d6 2a040d0bb9f335c12e7dd809d66b328e9114445eccfc79f5d797cc9636b6c72d 24fb4e14f8e2f2b663e3221132aec06f30eae68aea9ad4e927407ce6049a9ac1 31f46e524f3aabd1360cfe2c6dd74bf2b3a1e714723d5ecb759a48b9494352eb c6ddd8e919cc0b2eca8e9ee9a2bb7832fa96b5adab4cdf6c1fc8b87fae87bcb5 ~ CastleLoader C2 domains wereatwar[.]com ~ NetSupport RAT C2 37.230.62.235:514 37.230.62.235 84.200.81.32